AlmaLinux 9.6 [TuxCare] Security Update: perl-Archive-Tar (ALMALINUX9.6:CLSA-2026:1783078783)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783078783 advisory. - Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory...

PT-2026-103079

Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description An arbitrary file read flaw allows authenticated remote attackers to download arbitrary system files from the server. Recommendations At the moment, there is no information about a newe...

SUSE CVE-2026-101894

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

CVE-2026-13224 Fireware OS Path Traversal in WebUI Management Agent Allows Arbitrary Local File Read

A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request...

CVE-2026-13224

A path traversal vulnerability exists in the Fireware OS WebUI management agent . This flaw allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request. The vulnerability impacts the confidentiality of local syste...

CVE-2026-86136 Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user including a read-only or guest administrator account to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a...

CVE-2026-13224 Fireware OS Path Traversal in WebUI Management Agent Allows Arbitrary Local File Read

A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request...

CVE-2026-90441 Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user including a read-only or guest administrator account to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a...

CVE-2026-90441

The Fireware OS is affected by a missing authorization vulnerability in the wgagent management daemon's session initialization function. An authenticated, low-privileged user—such as a guest or read-only administrator—can submit a specially crafted management API request to crash the wgagent proc...

CVE-2026-90441 Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user including a read-only or guest administrator account to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a...

CVE-2026-102904

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...

EUVD-2026-64850

webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath...

GHSA-G84C-RXFJ-3J2C webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

!IMPORTANT CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were...

webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

!IMPORTANT CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were...

CVE-2026-102598

Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safejoin function used by sendfromdirectory can allow a NUL: special-device path because safejoin checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application runs o...

GitLab CVE-2026-85706 File Path LFI Detect

Detects CVE-2026-85706 in self-managed GitLab CE/EE before patched releases 17.11.7, 18.0.4, 18.1.2, 18.2.2, 18.3.2, 18.4.0: unauthenticated multipart uploads can supply file.path or metadata.path outside Workhorse temp dirs, leading to arbitrary file read. Sends a benign absolute-path probe only...

CVE-2024-1561

CVE-2024-1561 - Gradio 임의 파일 읽기 CVE-2024-1561 은 4.13.0 이전 Gradio 버전에 영향을 주는 임의 파일 읽기 취약점입니다. Gradio는 머신러닝 모델과 AI 애플리케이션용 웹 인터페이스를 빠르게 구축하는 데 사용되는 널리 알려진 Python 프레임워크입니다. 이 취약점은 /componentserver 엔드포인트가 내부 Component 클래스의 어떤 메서드를 호출할 수 있는지 제대로 제한하지 않기 때문에 발생합니다. 공격자는 이 동작을 악용하여 HTTP로 노출될 의도가 없는 메서드를...

resteasy security update

An update is available for resteasy. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list RESTEasy contains a JBoss project that provides frameworks to help build...

RLSA-2026:72424 Important: resteasy security update

RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification. Security Fixes: resteasy-core: RESTeasy SourceProvider remote unauthenticated file read...

PT-2026-102749

An unauthenticated attacker can make get page template page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE...